#
# requires: arch=amd64 vendor=intel nested -threaded
#
r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)

# Create three Intel nested VMs, each with one invalid host-state field in its VMCS:
# - VM 0: HOST_SS_SELECTOR with RPL bits set.
# - VM 1: non-canonical HOST_FS_BASE.
# - VM 2: HOST_IA32_EFER without LMA, although the host is 64-bit. KVM only checks
#   the field if the "load IA32_EFER" VM-exit control (bit 21) is set, so set it too.
# Each VMLAUNCH fails nested_vmx_check_host_state() with VM-instruction error 8
# (VMXERR_ENTRY_INVALID_HOST_STATE_FIELD), which SYZOS reports as 0xe2e10008.
#
r3 = syz_kvm_add_vcpu$x86(r2, &AUTO={0x0, &AUTO=[@enable_nested={AUTO, AUTO, 0x0}, @nested_create_vm={AUTO, AUTO, 0x0}, @nested_load_code={AUTO, AUTO, {0x0, "f4"}}, @nested_intel_vmwrite_mask={AUTO, AUTO, {0x0, @host16=0xc04, 0x3, 0x0, 0x0}}, @nested_vmlaunch={AUTO, AUTO, 0x0}, @nested_create_vm={AUTO, AUTO, 0x1}, @nested_load_code={AUTO, AUTO, {0x1, "f4"}}, @nested_intel_vmwrite_mask={AUTO, AUTO, {0x1, @host_nat=0x6c06, 0x8000000000000000, 0x0, 0x0}}, @nested_vmlaunch={AUTO, AUTO, 0x1}, @nested_create_vm={AUTO, AUTO, 0x2}, @nested_load_code={AUTO, AUTO, {0x2, "f4"}}, @nested_intel_vmwrite_mask={AUTO, AUTO, {0x2, @control32=0x400c, 0x200000, 0x0, 0x0}}, @nested_intel_vmwrite_mask={AUTO, AUTO, {0x2, @host64=0x2c02, 0x0, 0x400, 0x0}}, @nested_vmlaunch={AUTO, AUTO, 0x2}], AUTO})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, AUTO)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x1, r3, 0x0)

# VM 0.
#
ioctl$KVM_RUN(r3, AUTO, 0x0)
syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e10008)

# VM 1.
#
ioctl$KVM_RUN(r3, AUTO, 0x0)
syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e10008)

# VM 2.
#
ioctl$KVM_RUN(r3, AUTO, 0x0)
syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xe2e10008)
